CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.0 · CONSENSUS ASSESSMENTS INITIATIVE...

CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.0.1

OutSystems Cloud (updated September 2017)

OutSystems has been certified and attested to confirm compliance with ISO 27001, ISO 22301 and SOC 2 Type II standards, by independent auditors.Using the mapping between this questionnaire and the previous mentioned standards, it is possible to obtain a clearer vision how OutSystems Cloud complies with these controls.

Further details about these ISO certifications and SOC attestation and their contribute to OutSystems security practices can be found here: https://www.outsystems.com/company/trust/

OutSystems Cloud has various editions. OutSystems Sentry is the edition with more advanced security controls and some of the answers are marked as valid for this edition only. Contact OutSystems for information on the different editions.

The information in this document is detailed as of the time of authorship and does not amend or in any way alter OutSystems's security obligations as part of its contractual agreement with our customers.

OutSystems may discontinue or change the processes, procedures and controls described in this document at any time, without notice.

Control Domain Control ID

Question ID Control Specification Consensus Assessment Questions Consensus Assessment Answers Notes

CCM v3.0.1 Compliance Mapping

AICPA TSC 2014

ISO/IEC 27001:2013

Yes No Not Applicable

Application & Interface SecurityApplication Security

AIS-01 AIS-01.1 Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)?

X OutSystems ensures that all developers are given adequate training in issues relating to IT security and secure applications development. The specific secure coding guidelines used by OutSystems are OWASP Guide, SANS CWE Top 25 and CERT Secure Coding.

For instance, OutSystems features mechanisms that empower developers to build secure applications, with no vulnerabilities such as those listed in the OWASP Top 10, with minimal effort.

CC7.1 A9.4.2A9.4.1,8.1*Partial, A14.2.3,8.1*partial, A.14.2.7A12.6.1,A18.2.2

AIS-01.2 Do you use an automated source code analysis tool to detect security defects in code prior to production?

X Automated tools are used to detect vulnerability issues in the code (e.g. static code analysis). Customers can run their own static code analysis to detect vulnerabilities in their own code.

AIS-01.3 Do you use manual source-code analysis to detect security defects in code prior to production?

X When automated review is not possible or appropriate, manual code inspections are conducted by a suitably-qualified OutSystems developer, knowledgeable in code review techniques and secure coding practices who was not involved in writing the code being reviewed.

OutSystems SOC 2 reports provide further details on code review.AIS-01.4 Do you verify that all of your software suppliers adhere

to industry standards for Systems/Software Development Lifecycle (SDLC) security?

X OutSystems uses a security questionnaire to assess the capability of technological suppliers in terms of their software development lifecycle.

AIS-01.5 (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?

X OutSystems Cloud offer is PaaS based, by providing a platform which allows software (applications) development. However, OutSystems Cloud customers can run their own vulnerability scans and penetrations tests on their applications.

Application & Interface SecurityCustomer Access Requirements

AIS-02 AIS-02.1 Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed.

Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?

X The contract established between OutSystems and customers defines all requirements that have to be respected and followed by both parties.

CC5.1 A9.1.1.

AIS- 02.2 Are all requirements and trust levels for customers’ access defined and documented?

X The contract established between OutSystems and customers defines all requirements that have to be respected and followed by both parties.

Application & Interface SecurityData Integrity

AIS-03 AIS-03.1 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data?

X By default, applications developed using OutSystems feature data input and output integrity checks. Developers can override these patterns, even though the OutSystems developer environment will provide warnings for potential unsafe overrides.

PI1.2PI1.3PI1.5

A13.2.1,A13.2.2,A9.1.1,A9.4.1,A10.1.1A18.1.4

Application & Interface SecurityData Security / Integrity

AIS-04 AIS-04.1 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity, and availability) across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alternation, or destruction.

Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?

X Even though OutSystems provides the means for customers to protect their data, customers are still responsible for developing applications following best practices for data security.

CC5.6 A13.2.1,A13.2.2,A9.1.1,A9.4.1,A10.1.1A18.1.4

Audit Assurance & ComplianceAudit Planning

AAC-01 AAC-01.1 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

Do you produce audit assertions using a structured, industry accepted format (e.g., CloudAudit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)?

X OutSystems has been certified and attested to confirm compliance with ISO 27001, ISO 22301 and SOC 2 Type II standards, by independent auditors.Further details about these ISO certifications and SOC attestation and their contribute to OutSystems security practices can be found here: https://www.outsystems.com/company/trust/

CC4.1 Clauses4.3(a),4.3(b),5.1(e),5.1(f),6.2(e),9.1,9.1(e),9.2,9.3(f),A12.7.1

Audit Assurance & ComplianceIndependent Audits

AAC-02 AAC-02.1 Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.

Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports?

X OutSystems has been certified and attested to confirm compliance with ISO 27001, ISO 22301 and SOC 2 Type II standards, by independent auditors. Certificates and reports can be made available under NDA. The SOC3 report is publicly available here: https://www.outsystems.com/company/trust/

CC4.1 Clauses4.3(a),4.3(b),5.1(e),5.1(f),9.1,9.2,9.3(f),A18.2.1

AAC-02.2 Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?

X OutSystems performs regularly penetration tests on the OutSystems management consoles as well as internal and external vulnerability scans on a sample of customer OutSystems Cloud infrastructures. The level of standardization dismisses the needs for vulnerability scans specific to each, as the results and conclusions are transferrable across OutSystems Cloud infrastructures.

AAC-02.3 Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?

X OutSystems Cloud customers can run their own penetrations tests on their applications.

AAC-02.4 Do you conduct internal audits regularly as prescribed by industry best practices and guidance?

X OutSystems has an internal audit function, as required by ISO 27001 and ISO 22301.

AAC-02.5 Do you conduct external audits regularly as prescribed by industry best practices and guidance?

X OutSystems has external audits conducted by independent auditors, in order to achieve and maintain certifications and attestations (e.g. ISO 27001, ISO 22301, SOC 2 Type II).

AAC-02.6 Are the results of the penetration tests available to tenants at their request?

X OutSystems Cloud customers can run their own penetrations tests on their applications.

AAC-02.7 Are the results of internal and external audits available to tenants at their request?

X OutSystems has been certified and attested to confirm compliance with ISO 27001, ISO 22301 and SOC 2 Type II standards, by independent auditors. Certificates and reports can be made available under NDA. The SOC3 report is publicly available here: https://www.outsystems.com/company/trust/

AAC-02.8 Do you have an internal audit program that allows for cross-functional audit of assessments?

X OutSystems internal audit program addresses the certifications possessed, as required by ISO 27001 and ISO 22301.

Audit Assurance & ComplianceInformation System Regulatory Mapping

AAC-03 AAC-03.1 Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.

Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data?

X The OutSystems Cloud offer dedicates a Virtual Private Cloud (VPC) for each Enterprise customer, which ensures complete isolation of the environment of each customer/ tenant from other tenants.

OutSystems encrypts data-at-rest in production databases, by customer request, using the industry standard AES-256 encryption algorithm.

OutSystems SOC 2 reports provide further details on application security.

CC3.1 Clauses4.2(b),4.4,5.2(c),5.3(ab),6.1.2,6.1.3,6.1.3(b),7.5.3(b),7.5.3(d),8.1,8.39.2(g),9.3,9.3(b),9.3(f),10.2,A.8.2.1,A.18.1.1,A.18.1.3,A.18.1.4,A.18.1.5

AAC-03.2 Do you have the capability to recover data for a specific customer in the case of a failure or data loss?

X All database data is automatically backed up and maintained for 15 days, geo-redundantly replicated across multiple Availability Zones (within a Region). Backups are done with no downtime and a minimum impact. From the backups, OutSystems is able to recover all application source versions, all configurations and application runtime data.

AAC-03.3 Do you have the capability to restrict the storage of customer data to specific countries or geographic locations?

X OutSystems always keeps customer data in the AWS Region(s) selected by the customer, enabling compliance with data residency regulations.

AAC-03.4 Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements?

X OutSystems Legal team is responsible for monitoring and tracking of changes to legal requirements and that impact on OutSystems operation, as required by ISO 27001.

Business Continuity Management & Operational ResilienceBusiness Continuity Planning

BCR-01 BCR-01.1 A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: • Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval • Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information • Method for plan invocation

Do you provide tenants with geographically resilient hosting options?

X For even higher resilience, the OutSystems Cloud high-availability option allows customers to deploy front-ends across different AWS Availability Zones, and to set up a database replica in a different Availability Zone than the primary database. Each Availability Zone is designed as an independent failure zone.

CC3.1

A1.2

A1.3

Clause 5.1(h)A.17.1.2A.17.1.2

Business Continuity Management & Operational ResilienceBusiness Continuity Planning

BCR-01

BCR-01.2

A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: • Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval • Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information • Method for plan invocation

Do you provide tenants with infrastructure service failover capability to other providers?

X OutSystems main IaaS provider is AWS. However, OutSystems can also be installed in any other cloud service provider. Customers who use these other clouds are responsible for managing these infrastructures and installation of OutSystems.

More information:https://success.outsystems.com/Support/Enterprise_Customers/Installation/01_Install_and_set_up_OutSystems_Platform

CC3.1

A1.2

A1.3

Clause 5.1(h)A.17.1.2A.17.1.2

Business Continuity Management & Operational ResilienceBusiness Continuity Testing

BCR-02 BCR-02.1 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?

X OutSystems business continuity plans are tested at least on a yearly basis, aligned with ISO 27001 - Annex A and ISO 22301.

A1.2 A17.3.1

Business Continuity Management & Operational ResiliencePower / Telecommunications

BCR-03 BCR-03.1 Data center utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.

Do you provide tenants with documentation showing the transport route of their data between your systems?

X Data flows inside each environment are standard and are properly documented. If new versions of the platform alter the data flow, the new data flows will be documented.Data flows between customers applications and other systems are responsibility of the customer.

A1.1A1.2

A1.3

A11.2.2,A11.2.3

BCR-03.2 Can tenants define how their data is transported and through which legal jurisdictions?

X OutSystems always keeps customer data in the AWS Region(s) selected by the customer, enabling compliance with data residency regulations.Since OutSystems is a platform which allows software (applications) development, it features mechanisms that empower developers to build secure applications with minimal effort, including secure data transportation.

Business Continuity Management & Operational ResilienceDocumentation

BCR-04 BCR-04.1 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following: • Configuring, installing, and operating the information system • Effectively using the system’s security features

Are information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system?

X OutSystems provides documentation for continued provisioning of critical services in the event of a disaster, aligned with ISO 27001 - Annex A and ISO 22301.

CC1.3CC1.4

CC2.1

Clause 9.2(g)

Business Continuity Management & Operational ResilienceEnvironmental Risks

BCR-05 BCR-05.1 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.

Is physical protection against damage (e.g., natural causes, natural disasters, deliberate attacks) anticipated and designed with countermeasures applied?

X OutSystems relies on a remote physical site, which is located approximately 160km away from the main site, aligned with ISO 27001 - Annex A and ISO 22301.Outsystems relies on AWS cloud services, that are available in different geographic locations.

The IT infrastructure and operations that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including SOC 2 Type II and ISO 27001. More information: https://aws.amazon.com/security/

CC3.1

A1.1A1.2

A11.1.4,A11.2.1

Business Continuity Management & Operational ResilienceEquipment Location

BCR-06 BCR-06.1 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.

Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?

X Outsystems relies on AWS cloud services, that are available in different geographic locations.


CC3.1

A1.1A1.2

A11.2.1

Business Continuity Management & Operational ResilienceEquipment Maintenance

BCR-07 BCR-07.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities?

X The OutSystems Cloud high-availability option allows customers to deploy Front-Ends across different AWS Availability Zones, and to set up a database replica in a different Availability Zone than the primary database.

A1.1A1.2

CC4.1

A11.2.4

BCR-07.2 If using virtual infrastructure, do you provide tenants with a capability to restore a Virtual Machine to a previous state in time?

X All database data is automatically backed up and maintained for 15 days, geo-redundantly replicated across multiple Availability Zones (within a Region). Backups are done with no downtime and a minimum impact. Subscribers can request a database restore to any point in time in those 15 days.

BCR-07.3 If using virtual infrastructure, do you allow virtual machine images to be downloaded and ported to a new cloud provider?

X OutSystems Cloud is PaaS based, by providing a platform which allows software (applications) development. OutSystems provides segregated environments for development, testing and production, not virtual machines.

BCR-07.4 If using virtual infrastructure, are machine images made available to the customer in a way that would allow the customer to replicate those images in their own off-site storage location?

X OutSystems Cloud is PaaS based, by providing a platform which allows software (applications) development. OutSystems provides segregated environments for development, testing and production, not virtual machines.

BCR-07.5 Does your cloud solution include software/provider independent restore and recovery capabilities?

X OutSystems main IaaS provider is Amazon AWS. All database data are automatically backed up and maintained for 15 days, geo-redundantly replicated across multiple Availability Zones (within a Region). Backups are done with no downtime and a minimum impact. Subscribers can request a database restore to any point in time in those 15 days.

Customers can export all data from the database, and rebuild their OutSystems environment from the database onto a new infrastructure. OutSystems can also be installed in any other cloud service provider of an organization's choice, such as Microsoft Azure, Rackspace or VMWare.

Business Continuity Management & Operational ResilienceEquipment Power Failures

BCR-08 BCR-08.1 Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific business impact assessment.

Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)?

X OutSystems facilities have a set of protection mechanisms, aligned with ISO 27001 - Annex A and ISO 22301. OutSystems SOC 2 reports provide further details on facilities security mechanisms.


A1.1A1.2

A.11.2.2,A.11.2.3,A.11.2.4

Business Continuity Management & Operational Resilience Impact Analysis

BCR-09 BCR-09.1 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following: • Identify critical products and services • Identify all dependencies, including processes, applications, business partners, and third party service providers • Understand threats to critical products and services • Determine impacts resulting from planned or unplanned disruptions and how these vary over time • Establish the maximum tolerable period for disruption • Establish priorities for recovery • Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption • Estimate the resources required for resumption

Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule. OutSystems will also notify a customer about shortage of resources in its infrastructure, with ongoing communication via Support Portal.

AWS also provides the status of their services, regarding service availability, on AWS Service Health Dashboard, which includes the status history of 1 year.

OutSystems SOC 2 reports provide further details on monitoring controls.

CC3.1

A1.2

A1.3

A.17.1.1A.17.1.2

BCR-09.2 Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your tenants?

X As the OutSystems infrastructure capabilities are hosted in AWS, it is transparent for the customer the monitoring of these capabilities as it is assured by AWS.

BCR-09.3 Do you provide customers with ongoing visibility and reporting of your SLA performance?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule. OutSystems will also notify a customer about shortage of resources.

AWS also provides the status of their services, regarding service availability, on AWS Service Health Dashboard, which includes the status history of 1 year.

OutSystems SOC 2 reports provide further details on monitoring controls.

Business Continuity Management & Operational ResiliencePolicy

BCR-10 BCR-10.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.

Are policies and procedures established and made available for all personnel to adequately support services operations’ roles?

X OutSystems has a set of defined policies and procedures, aligned with our certifications and attestations (ISO 27001, ISO 22301 and SOC 2 Type II), as well as industry best practices, such as a Information Security Policy and a Business Continuity Policy.

CC3.2 Clause 5.1(h)A.6.1.1A.7.2.1A.7.2.2A.12.1.1

Business Continuity Management & Operational ResilienceRetention Policy

BCR-11 BCR-11.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.

Do you have technical control capabilities to enforce tenant data retention policies?

X OutSystems provides customers with the ability to delete their data. However, customers retain control and ownership of their data so it is the customer's responsibility to manage data retention to their own requirements. Customers can export their database data to implement other retention requirements.

Backups are assured by AWS, via Amazon RDS service. All database data is automatically backed up and maintained for 15 days.

OutSystems SOC 2 reports provide further details on backups and retention.

A1.2

A1.3

I3.21

Clauses9.2(g)7.5.3(b)5.2 (c)7.5.3(d)5.3(a)5.3(b)8.18.3A.12.3.1A.8.2.3

BCR-11.2 Do you have a documented procedure for responding to requests for tenant data from governments or third parties?

X All requests for data made from governments or third parties are analyzed by OutSystems Legal department, in conjunction with the customer's Legal area. This data will only be provided to those third parties, if there is a legal justification.

BCR-11.4 Have you implemented backup or redundancy mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?

X Backups are assured by AWS. All database data is automatically backed up and maintained for 15 days, geo-redundantly replicated across multiple Availability Zones (within a Region). Customers can export their database data to implement other retention requirements.


OutSystems SOC 2 reports provide further details on backups and retention.BCR-11.5 Do you test your backup or redundancy mechanisms at

least annually?X OutSystems can recover backup data, upon customer request, to check its integrity and

validity. Restore processes are tested routinely during support tasks.Change Control & Configuration ManagementNew Development / Acquisition

CCC-01 CCC-01.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization's business leadership or other accountable business role or function.

Are policies and procedures established for management authorization for development or acquisition of new applications, systems, databases, infrastructure, services, operations and facilities?

X OutSystems has a set of defined policies and procedures regarding software development and change management, aligned with ISO 27001 - Annex A and SOC 2 Type II, as well as industry best practices.

OutSystems SOC 2 reports provide further details on software development and change management.

CC7.2

CC7.1

CC7.4

A.14.1.1A.12.5.1A.14.3.1A.9.4.58.1* (partial) A.14.2.7A.18.1.3A.18.1.4

Change Control & Configuration ManagementNew Development / Acquisition

CCC-01

CCC-01.2

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization's business leadership or other accountable business role or function. Is documentation available that describes the

installation, configuration, and use of products/services/features?


OutSystems SOC 2 reports provide further details on software development and change management.

CC7.2

CC7.1

CC7.4

A.14.1.1A.12.5.1A.14.3.1A.9.4.58.1* (partial) A.14.2.7A.18.1.3A.18.1.4

Change Control & Configuration ManagementOutsourced Development

CCC-02 CCC-02.1 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g., ITIL service management processes).

Do you have controls in place to ensure that standards of quality are being met for all software development?

X There are no outsourced software development activities at OutSystems. CC7.1

CC7.4

A18.2.1A.15.1.2A.12.1.48.1* (partial)8.1* (partial) A.15.2.18.1* (partial) A.15.2.2A.14.2.9A.14.1.1A.12.5.1A.14.3.1A.9.4.58.1* (partial) A.14.2.28.1* (partial) A.14.2.38.1* (partial) A.14.2.48.1* (partial) A.14.2.7A.12.6.1A.16.13A.18.2.2A.18.2.3

CCC-02.2 Do you have controls in place to detect source code security defects for any outsourced software development activities?

X There are no outsourced software development activities at OutSystems.

Change Control & Configuration ManagementQuality Testing

CCC-03 CCC-03.1 Organizations shall follow a defined quality change control and testing process (e.g., ITIL Service Management) with established baselines, testing, and release standards which focus on system availability, confidentiality, and integrity of systems and services.

Do you provide your tenants with documentation that describes your quality assurance process?


OutSystems SOC 2 reports provide further details on quality assurance.

CC7.1CC7.1CC7.1CC7.1

CC7.4

A.6.1.1A.12.1.1A.12.1.4A.14.2.9A.14.1.1A.12.5.1A.14.3.1A.9.4.58.1* partial A.14.2.28.1* partial A.14.2.38.1* partial A.14.2.4A.12.6.1A.16.1.3A.18.2.2A.18.2.3

CCC-03.2 Is documentation describing known issues with certain products/services available?

X OutSystems has a publicly available Release Notes website, where it is described new bug fixes for each new release.

More information:https://success.outsystems.com/Documentation/10/Release_Notes

CCC-03.3 Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?

X The contacts to OutSystems support as well as the technical support terms of use are publicly available. Depending on the severity of the envolved alerts, different processes shall be used, with different response times. OutSystems SOC 2 reports provide further details on incident response.

More information: https://success.outsystems.com/Support/Enterprise_Customers/OutSystems_Support/01_Contact_OutSystems_technical_supporthttps://success.outsystems.com/Support/Enterprise_Customers/OutSystems_Support/Support_Terms

CCC-03.4 Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?

X All test data and development, test and/or custom application accounts, user IDs, and passwords are removed before applications become active or are released to customers.

Change Control & Configuration ManagementUnauthorized Software Installations

CCC-04 CCC-04.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?

X OutSystems has defined policies and implemented controls concerning the use of devices and systems, specifically regarding software installation, aligned with ISO 27001 - Annex A.

OutSystems Cloud customers cannot log into the servers running OutSystems Platform, and therefore cannot install software.

CC5.5

CC5.8

CC7.4

A.6.1.2A.12.2.1A.9.4.4A.9.4.1A.12.5.18.1* (partial) A.14.2.4

Change Control & Configuration ManagementProduction Changes

CCC-05 CCC-05.1 Policies and procedures shall be established for managing the risks associated with applying changes to: • Business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations. • Infrastructure network and systems components.Technical measures shall be implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer (tenant), and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.

Do you provide tenants with documentation that describes your production change management procedures and their roles/rights/responsibilities within it?


OutSystems SOC 2 reports provide further details on quality assurance.

CC7.4CC7.4

A.12.1.48.1* (partial) A.14.2.28.1* (partial) A.14.2.3

Data Security & Information Lifecycle ManagementClassification

DSI-01 DSI-01.1 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country)?

X OutSystems Cloud is PaaS based, by providing a platform which allows software (applications) development. OutSystems provides segregated environments for development, testing and production, which are identifiable through the platform.

CC3.1

CC3.1

A.8.2.1

DSI-01.2 Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)?

X OutSystems Cloud is PaaS based, by providing a platform which allows software (applications) development. OutSystems provides segregated environments for development, testing and production, which are identifiable through the platform.

DSI-01.3 Do you have a capability to use system geographic location as an authentication factor?

X With OutSystems, any authentication mechanism can be implemented depending on the application design, including the usage of system geographic location.

DSI-01.4 Can you provide the physical location/geography of storage of a tenant’s data upon request?

X OutSystems always keeps customer data in the AWS Region(s) selected by the customer.

DSI-01.5 Can you provide the physical location/geography of storage of a tenant's data in advance?

X OutSystems always keeps customer data in the AWS Region(s) selected by the customer.

DSI-01.6 Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)?

X OutSystems Cloud customers retain control and ownership of their data and may implement a structured data-labeling standard to meet their requirements.

OutSystems has an internal information classification policy that defines the levels of classification and corresponding access restrictions and handling methodology, aligned with ISO 27001 - Annex A.

DSI-01.7 Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation?

X Customers are allowed to choose the AWS Region(s) from where they want the service to be provided.

Data Security & Information Lifecycle ManagementData Inventory / Flows

DSI-02 DSI-02.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's geographically distributed (physical and virtual) applications and infrastructure network and systems components and/or shared with other third parties to ascertain any regulatory, statutory, or supply chain agreement (SLA) compliance impact, and to address any other business risks associated with the data. Upon request, provider shall inform customer (tenant) of compliance impact and risk, especially if customer data is used as part of the services.

Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?

X Data flows inside each environment are standard and are properly documented. If new versions of the platform alter the data flow, the new data flows will be documented.

Clause4.25.2,7.5,8.1

DSI-02.2 Can you ensure that data does not migrate beyond a defined geographical residency?

X OutSystems always keeps customer data in the AWS Region(s) selected by the customer. The data will not be moved to another region, unless it is requested by the customer or moved by the customer.

Data Security & Information Lifecycle ManagementE-commerce Transactions

DSI-03 DSI-03.1 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?

X Customers are given the proper tools to protect their data in transit. By default, HTTP/SSL encryption with TLS 1.2 is always used for both pages and exposed services. Additionally, all communications can be tunnelled through a secure VPN tunnel.

OutSystems SOC 2 reports provide further details on data security.

CC5.7

PI1.5

A.8.2.1A.13.1.1A.13.1.2A.14.1.2A.14.1.3A.18.1.4

DSI-03.2 Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?

X Customers are given the proper tools to protect their data in transit. By default, HTTP/SSL encryption with TLS 1.2 is always used for both pages and exposed services. Additionally, all communications can be tunnelled through a secure VPN tunnel. Additionally, AWS provides a set of security features regarding confidentiality of customer's data.

OutSystems SOC 2 reports provide further details on data security.Data Security & Information Lifecycle ManagementHandling / Labeling / Security Policy

DSI-04 DSI-04.1 Policies and procedures shall be established for labeling, handling, and the security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

Are policies and procedures established for labeling, handling and the security of data and objects that contain data?

X OutSystems has an internal information classification policy that defines the levels of classification and corresponding access restrictions and handling methodology, aligned with ISO 27001 - Annex A.

OutSystems Cloud customers retain control and ownership of their data and may implement a labeling and handling policy and procedures to meet their requirements.

CC5.1 A.8.2.2A.8.3.1A.8.2.3A.13.2.1

DSI-04.2 Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?

X OutSystems has an internal information classification policy that defines the levels of classification and corresponding access restrictions and handling methodology, aligned with ISO 27001 - Annex A.

OutSystems Cloud customers retain control and ownership of their data and may implement a labeling and handling policy and procedures to meet their requirements. If a container contains two types of data that are labeled with different confidentiality levels, the more restrictive level must be applied for the whole container.

Data Security & Information Lifecycle ManagementNonproduction Data

DSI-05 DSI-05.1 Production data shall not be replicated or used in non-production environments. Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?

X By default, OutSystems platform segregates production data from other non production data, ensuring that no data transits from one environment to the others. However, it is responsibility of the customer to guarantee that production data is not used in non-production environments.

C1.3

CC5.6

C1.1

A.8.1.3A.12.1.4A.14.3.18.1* (partial) A.14.2.2.

Data Security & Information Lifecycle ManagementOwnership / Stewardship

DSI-06 DSI-06.1 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

Are the responsibilities regarding data stewardship defined, assigned, documented, and communicated?

X The responsibilities, for both OutSystems and customers, regarding data ownership and intellectual property are defined, assigned, documented and communicated in the OutSystems Master Subscription Agreement.

CC2.3

CC3.1

A.6.1.1A.8.1.2A.18.1.4

Data Security & Information Lifecycle ManagementSecure Disposal

DSI-07 DSI-07.1 Policies and procedures shall be established with supporting business processes and technical measures implemented for the secure disposal and complete removal of data from all storage media, ensuring data is not recoverable by any computer forensic means.

Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant?

X Live data lifecycle is the responsibility of each tenant. Upon termination of the OutSystems Cloud Enterprise Subscription, OutSystems will keep customer data for 30 days. After that, OutSystems will destroy the virtual infrastructure of the customer.AWS is then responsible for ensuring customer data is not exposed to unauthorized individuals, including the best practices for destroying data upon the end of life of storage devices.


C1.3

CC5.6

A.11.2.7A.8.3.2

DSI-07.2 Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?

X This is assured by AWS: https://aws.amazon.com/security/

The IT infrastructure and operations that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including SOC 2 Type II and ISO 27001.

Datacenter SecurityAsset Management

DCS-01 DCS-01.1 Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities.

Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset?

X OutSystems maintains an inventory of critical assets and their corresponding owner, aligned with ISO 27001 - Annex A.

CC3.1

CC3.1

Annex A.8

DCS-01.2 Do you maintain a complete inventory of all of your critical supplier relationships?

X OutSystems maintains a list of critical suppliers, aligned with ISO 27001 - Annex A.

Datacenter SecurityControlled Access Points

DCS-02 DCS-02.1 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) implemented?

X OutSystems facilities have a set of physical security protection mechanisms, aligned with ISO 27001 - Annex A and ISO 22301. OutSystems SOC 2 reports provide further details on facilities security mechanisms.


CC5.5 A.11.1.1A.11.1.2

Datacenter SecurityEquipment Identification

DCS-03 DCS-03.1 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location?

X Only authorized devices can connect to OutSystems network. Access to AWS accounts is restricted by two factor authentication mechanisms and service management can only be done from restrict IPs.

CC5.1

Datacenter SecurityOffsite Authorization

DCS-04 DCS-04.1 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another (e.g., offsite backups, business continuity failovers, replication)?


CC5.1

CC5.5

A.11.2.6A.11.2.7

Datacenter SecurityOffsite Equipment

DCS-05 DCS-05.1 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premise. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full write of the drive to ensure that the erased drive is released to inventory for reuse and deployment or securely stored until it can be destroyed.

Can you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment?

X OutSystems has a set of policies and procedures that states the measures that must be taken when disposing internal equipment, aligned with ISO 27001 - Annex A and SOC 2 Type II. OutSystems SOC 2 reports provide further details on asset disposal and destruction.

The IT infrastructure that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including SOC 2 Type II and ISO 27001.

CC5.6 A.8.1.1A.8.1.2

Datacenter SecurityPolicy

DCS-06 DCS-06.1 Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

Can you provide evidence that policies, standards, and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas?

X OutSystems has defined internal policies providing guidelines on how to maintain a safe and secure working environment in offices, rooms, facilities, and secure areas, aligned with ISO 27001 - Annex A and SOC 2 Type II.

OutSystems SOC 2 reports provide further details on secure working environments.

CC5.5 A.11.1.1A.11.1.2

DCS-06.2 Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards, and procedures?

X OutSystems maintains a training program, that pursues the full adaptation of a new employee to the work environment. Among other security training programs, the operational teams receive additional and specific security awareness training. The frequency of this training is continual and occurs at least yearly, as required by ISO 27001, ISO 22301 and SOC 2 Type II.

OutSystems SOC 2 reports provide further details on security awareness training.Datacenter SecuritySecure Area Authorization

DCS-07 DCS-07.1 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)?


CC5.5 A.11.1.6

Datacenter SecurityUnauthorized Persons Entry

DCS-08 DCS-08.1 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process?

X OutSystems facilities have a set of physical security protection mechanisms, aligned with ISO 27001 - Annex A and ISO 22301. OutSystems SOC 2 reports provide further details on facilities security mechanisms.


CC5.5 A.11.2.58.1* (partial) A.12.1.2

Datacenter SecurityUser Access

DCS-09 DCS-09.1 Physical access to information assets and functions by users and support personnel shall be restricted.

Do you restrict physical access to information assets and functions by users and support personnel?

X OutSystems only provides access and information to employees who have a legitimate business need for such privileges, aligned with ISO 27001 - Annex A and SOC 2 Type II. OutSystems SOC 2 reports provide further details on physical access management.

The IT infrastructure that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including SOC 2 Type II and ISO 27001.

CC5.5 A.11.1.1

Encryption & Key ManagementEntitlement

EKM-01

EKM-01.1 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.

Do you have key management policies binding keys to identifiable owners?

X OutSystems has defined internal policies and procedures regarding key management describing how encryption keys are managed through their lifecycle and protected against unauthorized use, aligned with ISO 27001 - Annex A.

AnnexA.10.1A.10.1.1A.10.1.2

Encryption & Key ManagementKey Generation

EKM-02

EKM-02.1 Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control.

Do you have a capability to allow creation of unique encryption keys per tenant?

X Unique encryption keys are generated for each tenant and are only used inside the tenant environment.

CC5.7

CC5.6

Clauses5.2(c)5.3(a)5.3(b)7.5.3(b)7.5.3(d)8.18.39.2(g)A.8.2.3A.10.1.2A.18.1.5

EKM-02.2 Do you have a capability to manage encryption keys on behalf of tenants?

X Key management is performed by AWS by default, but can also be performed by OutSystems.


EKM-02.3 Do you maintain key management procedures? X OutSystems has defined internal policies and procedures regarding key management describing how encryption keys are managed through their lifecycle and protected against unauthorized use, aligned with ISO 27001 - Annex A.

EKM-02.4 Do you have documented ownership for each stage of the lifecycle of encryption keys?


EKM-02.5 Do you utilize any third party/open source/proprietary frameworks to manage encryption keys?

X Key management is performed by AWS by default, but can also be performed by OutSystems. Tenants can implement, at the application level, their own encryption schemes using their own keys.


Encryption & Key ManagementEncryption

EKM-03

EKM-03.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations) and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

Do you encrypt tenant data at rest (on disk/storage) within your environment?

X OutSystems encrypts data at rest in production databases, by customer request, including the underlying storage for a DB instance. Encrypted databases use the industry standard AES-256 encryption algorithm.

CC5.7

CC5.6

A.13.1.1A.8.3.3A.13.2.3A.14.1.3A.14.1.2A.10.1.1A.18.1.3A.18.1.4

EKM-03.2 Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?

X Customers are given the proper tools to protect their data in transit. For instance, by default, HTTP/SSL encryption with TLS 1.2 is always used for both pages and exposed services. Additionally, all communications can be tunnelled through a secure VPN tunnel. Additionally, AWS provides a set of security features regarding confidentiality of customer's data.

EKM-03.3 Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g., identity-based encryption)?

X Tenants can implement, at the application level, their own encryption schemes using their own keys.

EKM-03.4 Do you have documentation establishing and defining your encryption management policies, procedures, and guidelines?


Encryption & Key ManagementStorage and Access

EKM-04

EKM-04.1 Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms?

X As an example, OutSystems Cloud uses AES-256 as the symmetric encryption algorithm for the database.

AnnexA.10.1A.10.1.1A.10.1.2EKM-04.2 Are your encryption keys maintained by the cloud

consumer or a trusted key management provider?X Key management is performed by AWS by default, but can also be performed by OutSystems.

Tenants can implement, at the application level, their own encryption schemes using their own keys.


EKM-04.3 Do you store encryption keys in the cloud? X Key management is performed by AWS by default, but can also be performed by OutSystems.Tenants can implement, at the application level, their own encryption schemes using their own keys.


EKM-04.4 Do you have separate key management and key usage duties?

X Key management is performed by AWS by default, but can also be performed by OutSystems.Tenants can implement, at the application level, their own encryption schemes using their own keys.


Governance and Risk ManagementBaseline Requirements

GRM-01

GRM-01.1 Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system, and network components that comply with applicable legal, statutory, and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and authorized based on business needs.

Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?

X OutSystems Cloud applies security best practices and inherits the security protections of both Amazon AWS and OutSystems Platform, including several security hardening methods. Configuration standards are based on AWS and third-party hardening guides from well reputed industry sources.

CC3.2 A.14.1.1A.18.2.3

GRM-01.2 Do you have the capability to continuously monitor and report the compliance of your infrastructure against your information security baselines?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule. The OutSystems Cloud virtual machine images are patched and hardened. OutSystems regularly reviews the configuration standards for OutSystems Cloud environments.

GRM-01.3 Do you allow your clients to provide their own trusted virtual machine image to ensure conformance to their own internal standards?

X The OutSystems Cloud virtual machine images are regularly patched and hardened (including the removal of unnecessary services). Any configuration standard change is duly justified and recorded.

Governance and Risk ManagementRisk Assessments

GRM-02

GRM-02.1 Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following: • Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements • Data classification and protection from unauthorized use, access, loss, destruction, and falsification

Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule, including critical system health indicators. Any suspicious value triggers either self-healing mechanisms or an alarm to the OutSystems support team.OutSystems provides monitoring tools enabling a proactive management of application performance, including performance monitoring, including client-side, network and server analytics.

OutSystems provides monitoring tools enabling a proactive management of application performance, including performance monitoring, including client-side, network and server analytics.

CC3.1

CC3.1

Clauses5.2(c)5.3(a)5.3(b)6.1.26.1.2(a)(2)6.1.3(b)7.5.3(b)7.5.3(d)8.18.28.39.2(g)A.18.1.1A.18.1.3A.18.1.4A.8.2.2

GRM-02.2 Do you conduct risk assessments associated with data governance requirements at least once a year?

X OutSystems performs risk assessments at least on an annual basis, as required by ISO 27001 and 22301. OutSystems SOC 2 reports provide further details on risk assessment.

Governance and Risk ManagementManagement Oversight

GRM-03

GRM-03.1 Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

Are your technical, business, and executive managers responsible for maintaining awareness of and compliance with security policies, procedures, and standards for both themselves and their employees as they pertain to the manager and employees' area of responsibility?

X Each OutSystems manager is responsible for ensuring that their respective employees and business partners complete mandatory security awareness training, as required by ISO 27001, ISO 22301 and SOC 2 Type II. CC3.2

Clause 7.2(a,b)A.7.2.1A.7.2.2A.9.2.5A.18.2.2

Governance and Risk ManagementManagement Program

GRM-04

GRM-04.1 An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business: • Risk management • Security policy • Organization of information security • Asset management • Human resources security • Physical and environmental security • Communications and operations management • Access control • Information systems acquisition, development, and maintenance

Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?

X OutSystems provides tenants with its security documentation that describes how we address information security as as organization and in our services. This documentation can be accessed here: https://www.outsystems.com/company/trust/.We also maintain our internal information security management system (ISMS) and business continuity management system (BCMS) documentation required by ISO 27001 and ISO 22301. OutSystems SOC 2 reports provide further details on ISMS and BCMS.

All in sections 4, 5, 6, 7, 8, 9, 10.A.6.1.1A.13.2.4A.6.1.3A.6.1.4A.18.2.1GRM-04.2 Do you review your Information Security Management

Program (ISMP) at least once a year?X All OutSystems information security policies are reviewed when necessary or at least on an

annual basis.

Governance and Risk ManagementManagement Support / Involvement

GRM-05

GRM-05.1 Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

Do you ensure your providers adhere to your information security and privacy policies?

X OutSystems collects SOC 2 reports from technological providers on an annual basis and uses a security questionnaire to assess the capability of technological suppliers to provide the contracted services in terms of security. Depending on the results of this questionnaire, OutSystems may enforce the adherence to its information security and privacy policies. OutSystems SOC 2 reports provide further details on supplier management.

CC1.2 All in section 5 plus clauses4.44.2(b)6.1.2(a)(1)6.26.2(a)6.2(d)7.17.49.310.27.2(a)7.2(b)7.2(c)7.2(d)7.3(b)7.3(c)

Governance and Risk ManagementPolicy

GRM-06

GRM-06.1 Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.

Do your information security and privacy policies align with industry standards (ISO-27001, ISO-22307, CoBIT, etc.)?

X OutSystems has an ISMS aligned with ISO 27001 and a BCMS aligned with ISO 22301. Both of these management systems have been certified by independent auditors.

CC3.2

CC1.2

CC2.3

Clause 4.3Clause 54.44.2(b)6.1.2(a)(1)6.26.2(a)6.2(d)7.17.49.310.27.2(a)7.2(b)7.2(c)7.2(d)7.3(b)7.3(c)A5.1.1A.7.2.2

GRM-06.2 Do you have agreements to ensure your providers adhere to your information security and privacy policies?

X OutSystems collects SOC 2 reports from technological providers on an annual basis and uses a security questionnaire to assess the capability of technological suppliers to provide the contracted services in terms of security. Depending on the results of this questionnaire, OutSystems may enforce the adherence to its information security and privacy policies. OutSystems SOC 2 reports provide further details on supplier management.

GRM-06.3 Can you provide evidence of due diligence mapping of your controls, architecture, and processes to regulations and/or standards?

X OutSystems has mapped its security controls to the requirements of ISO 27001, ISO 22301, SOC 2 Type II. You may also refer to CSA CCM v3.0.1 Compliance Mapping.

GRM-06.4 Do you disclose which controls, standards, certifications, and/or regulations you comply with?

X OutSystems has been certified and attested to confirm compliance with ISO 27001, ISO 22301 and SOC 2 Type II standards, by independent auditors.

Governance and Risk ManagementPolicy Enforcement

GRM-07

GRM-07.1 A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?

X OutSystems has defined acceptable use policies which were distributed to all OutSystems employees and require acknowledgement by employees, referring that violations of those policies may be subject to disciplinary action, aligned with ISO 27001 - Annex A.

CC6.2

CC2.5

A7.2.3

GRM-07.2 Are employees made aware of what actions could be taken in the event of a violation via their policies and procedures?

X OutSystems has defined acceptable use policies which were distributed to all OutSystems employees and require acknowledgement by employees, referring that violations of those policies may be subject to disciplinary action.

Governance and Risk ManagementBusiness / Policy Change Impacts

GRM-08

GRM-08.1 Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.

Do risk assessment results include updates to security policies, procedures, standards, and controls to ensure they remain relevant and effective?

X All OutSystems information security policies are reviewed when necessary (e.g. due to new risks) or at least on an annual basis, aligned with ISO 27001 - Annex A.

Clause4.2.1 a,4.2(b)4.3 c,4.3(a&b)4.45.1(c)5.1(d)5.1(e)5.1(f)5.1(g)5.1(h)5.25.2 e,5.2(f)5.36.1.1(e)(2),6.1.2(a)(1)6.26.2(a)6.2(d)6.2 e,6.12 (a) (2),7.17.2(a),7.2(b)7.2(c)7.2(d)7.3(b),7.3(c)7.47.5.1 (a)8.1*, partial8.29.19.1 e,9.2,9.39.3(a)9.3(b&f)9.3(c),9.3(c)(1)9.3(c)(2),9.3(c)(3)9.3(d)9.3(e)10.1(c)10.2,A.5.1.2A.12.1.2A.15.2.2A.17.1.1A.18.2.2A.18.2.3

Governance and Risk ManagementPolicy Reviews

GRM-09

GRM-09.1 The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

Do you notify your tenants when you make material changes to your information security and/or privacy policies?

X OutSystems notifies tenants of material changes to our website privacy statement, by placing prominent notice on it.

CC3.2 Clause 8.1A.5.1.2

Governance and Risk ManagementPolicy Reviews

GRM-09

GRM-09.2

The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

Do you perform, at minimum, annual reviews to your privacy and security policies?

X All OutSystems information security policies are reviewed when necessary or at least on an annual basis, aligned with ISO 27001 - Annex A.

CC3.2 Clause 8.1A.5.1.2

Governance and Risk ManagementAssessments

GRM-10

GRM-10.1 Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?

X OutSystems performs risk assessments at least on an annual basis, as required by ISO 27001 and ISO 22301. OutSystems SOC 2 reports provide further details on risk management.

CC3.1

CC3.3

Clause4.2(b),6.1.1,6.1.1(e)(2)6.1.26.1.2(a)(1)6.1.2(a)(2),6.1.2(b)6.1.2 (c)6.1.2(c)(1),6.1.2(c)(2)6.1.2(d)6.1.2(d)(1)6.1.2(d)(2)6.1.2(d)(3)6.1.2(e)6.1.2(e)(1)6.1.2(e)(2)6.1.3,6.1.3(a)6.1.3(b)8.19.3(a),9.3(b)9.3(b)(f)9.3(c)9.3(c)(1)9.3(c)(2)9.3(c)(3)9.3(d)9.3(e)9.3(f)A.14.2.3A.12.6.1A.17.1.1A.18.1.1A.18.2.2A.18.2.3

GRM-10.2 Is the likelihood and impact associated with inherent and residual risk determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance)?

X OutSystems performs risk assessments at least on an annual basis, as required by ISO 27001 and ISO 22301. OutSystems SOC 2 reports provide further details on risk management.

Governance and Risk ManagementProgram

GRM-11

GRM-11.1 Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and stakeholder approval.

Do you have a documented, organization-wide program in place to manage risk?

X OutSystems has defined internal policies and procedures regarding risk management addressing the methodology for assessment and treatment of information security risks in Outsystems, and the acceptable level of risk, as required by ISO 27001 and ISO 22301. OutSystems SOC 2 reports provide further details on risk management.

CC3.1 Clause6.1.1,6.1.1(e)(2)6.1.26.1.2(a)(1)6.1.2(a)(2),6.1.2(b)6.1.2 (c)6.1.2(c)(1),6.1.2(c)(2)6.1.2(d)6.1.2(d)(1)6.1.2(d)(2)6.1.2(d)(3)6.1.2(e)6.1.2(e)(1)6.1.2(e)(2)6.1.3,6.1.3(a)6.1.3(b)8.39.3(a),9.3(b)9.3(b)(f)9.3(c)9.3(c)(1)9.3(c)(2)9.3(c)(3)9.3(d)9.3(e)9.3(f)A.12.6.1A.17.1.1A.18.2.2A.18.2.3

GRM-11.2 Do you make available documentation of your organization-wide risk management program?

X OutSystems has defined internal policies and procedures regarding risk management, as required by ISO 27001 and 22301. This is made available to all individuals that may participate in or need to be informed of risk management and assessment programs. OutSystems SOC 2 reports provide further details on risk management.

Human ResourcesAsset Returns

HRS-01 HRS-01.1 Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

Are systems in place to monitor for privacy breaches and notify tenants expeditiously if a privacy event may have impacted their data?

X Any unexpected alert, including privacy breaches, either automatically detected or resulting from a human log review, will trigger a Security Incident Response. The Security Incident Response Policy is available at https://success.outsystems.com/Support/Unlisted/Support_Team/Security_Incident_Response_Policy

CC5.6 A.8.1.1A.8.1.2A.8.1.4

HRS-01.2 Is your Privacy Policy aligned with industry standards? X OutSystems privacy policy is aligned with ISO 27001 - Annex A, other industry standards and best practices.

Human ResourcesBackground Screening

HRS-02 HRS-02.1 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

Pursuant to local laws, regulations, ethics, and contractual constraints, are all employment candidates, contractors, and involved third parties subject to background verification?

X The recruitment and selection process at OutSystems includes a set of screening procedures, aligned with ISO 27001 - Annex A. OutSystems SOC 2 report provides further details on background screening.

CC1.3CC1.4

A.7.1.1

Human ResourcesEmployment Agreements

HRS-03 HRS-03.1 Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

Do you specifically train your employees regarding their specific role and the information security controls they must fulfill?

X OutSystems maintains a training program, that pursues the full adaptation of a new employee to the work environment. Among other security training programs, the operational teams receive additional and specific security awareness training. The frequency of this training is continual and occurs at least yearly, as required by ISO 27001, ISO 22301 and SOC 2 Type II.

OutSystems SOC 2 reports provide further details on security awareness training.

CC2.2CC2.3

A.13.2.4A.7.1.2

HRS-03.2 Do you document employee acknowledgment of training they have completed?

X Employees are required to acknowledge the training they have completed, either automatically or manually.

HRS-03.3 Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?

X The contracts established by OutSystems with their employees have statements regarding data privacy and confidentiality, both internal and customer related. Moreover, OutSystems has defined acceptable use policies which require acknowledgement by employees, defining guidelines regarding confidentiality, aligned with ISO 27001 - Annex A.

HRS-03.4 Is successful and timed completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems?

X In certain OutSystems functions, access to determined tools and environments is only possible after completing the training program.

HRS-03.5 Are personnel trained and provided with awareness programs at least once a year?

X The frequency of the information security awareness training is continual and occurs at least yearly, aligned with ISO 27001 - Annex A.

Human ResourcesEmployment Termination

HRS-04 HRS-04.1 Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

Are documented policies, procedures, and guidelines in place to govern change in employment and/or termination?

X OutSystems has a set of policies and procedures with guidelines in case of new hires, change in employment and termination of functions, approaching access management and assign/ return of assets, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on employment termination.

CC5.4 A.7.3.1

HRS-04.2 Do the above procedures and guidelines account for timely revocation of access and return of assets?

X OutSystems has a set of policies and procedures with guidelines in case of new hires, change in employment and termination of functions, approaching access management and assign/ return of assets, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on employment termination.

Human ResourcesPortable / Mobile Devices

HRS-05 HRS-05.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (e.g., laptops, cell phones, and personal digital assistants (PDAs)), which are generally higher-risk than non-portable devices (e.g., desktop computers at the provider organization’s facilities)?

X OutSystems has defined a set of policies regarding the use of mobile devices, aligned with ISO 27001 - Annex A.

CC5.6 A.8.2.1A.8.3.1A.8.3.2A.8.3.3A.6.2.1A.6.2.2A.18.1.4

Human ResourcesNon-Disclosure Agreements

HRS-06 HRS-06.1 Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented, and reviewed at planned intervals?

X OutSystems Legal team manages and periodically revises the OutSystems NDAs and confidentiality agreements in accordance with business needs.

CC4.1 A.13.2.4

Human ResourcesRoles / Responsibilities

HRS-07 HRS-07.1 Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.

Do you provide tenants with a role definition document clarifying your administrative responsibilities versus those of the tenant?

X The responsibilities, for both OutSystems and customers, are defined, assigned, documented and communicated in the OutSystems Master Subscription Agreement.

Clause 5.3A.6.1.1A.6.1.1

Human ResourcesAcceptable Use

HRS-08 HRS-08.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

Do you provide documentation regarding how you may access tenant data and metadata?

X OutSystems Master Subscription Agreement defines how customer data is processed. CC3.2

CC6.2

A.8.1.3

HRS-08.2 Do you collect or create metadata about tenant data usage through inspection technologies (e.g., search engines, etc.)?

X OutSystems Master Subscription Agreement defines how customer data is processed.

HRS-08.3 Do you allow tenants to opt out of having their data/metadata accessed via inspection technologies?


Human ResourcesTraining / Awareness

HRS-09 HRS-09.1 A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

Do you provide a formal, role-based, security awareness training program for cloud-related access and data management issues (e.g., multi-tenancy, nationality, cloud delivery model, segregation of duties implications, and conflicts of interest) for all persons with access to tenant data?

X OutSystems maintains a training program which is given to all OutSystems employees and addresses areas such as cloud-related access, segregation of duties and data management issues, as required by ISO 27001. CC2.2

CC2.3

Clause 7.2(a), 7.2(b)A.7.2.2

HRS-09.2 Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity?

X OutSystems maintains a training program which is given to all OutSystems employees, including system and database administrators, and addresses areas such as data security and integrity, as required by ISO 27001.

Human ResourcesUser Responsibility

HRS-10 HRS-10.1 All personnel shall be made aware of their roles and responsibilities for: • Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. • Maintaining a safe and secure working environment

Are users made aware of their responsibilities for maintaining awareness and compliance with published security policies, procedures, standards, and applicable regulatory requirements?

X OutSystems maintains a training program which is given to all OutSystems employees, as required by ISO 27001. Customers are responsible for training their users.

CC3.2 Clause 7.2(a), 7.2(b)A.7.2.2A.9.3.1A.11.2.8

Human ResourcesUser Responsibility

HRS-10

HRS-10.2

All personnel shall be made aware of their roles and responsibilities for: • Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. • Maintaining a safe and secure working environment

Are users made aware of their responsibilities for maintaining a safe and secure working environment?


CC3.2 Clause 7.2(a), 7.2(b)A.7.2.2A.9.3.1A.11.2.8

HRS-10.3 Are users made aware of their responsibilities for leaving unattended equipment in a secure manner?


Human ResourcesWorkspace

HRS-11 HRS-11.1 Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions had been disabled after an established period of inactivity.

Do your data management policies and procedures address tenant and service level conflicts of interests?

X OutSystems has defined internal policies addressing conflicts of interest. CC5.5

CC5.6

Clause 7.2(a), 7.2(b)A.7.2.2A.11.1.5A.9.3.1A.11.2.8A.11.2.9

HRS-11.2 Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?

X OutSystems has a defined set of policies and procedures regarding access management, in particular on prevention and detection of unauthorized access, aligned with ISO 27001 - Annex A.OutSystems SOC 2 reports provide further details on access management.

HRS-11.3 Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?

X All accesses and management actions to AWS virtual machines management consoles are tracked via AWS CloudTrail. Direct access to virtual machines is logged and user activity and changes tracked.

Identity & Access ManagementAudit Tools Access

IAM-01 IAM-01.1 Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

Do you restrict, log, and monitor access to your information security management systems (e.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)?

X Only authorized OutSystems employees can access systems, considering their functions and on a need to know basis. This is enforced by identity and access control mechanisms present on each system.

CC5.1

IAM-01.2 Do you monitor and log privileged access (e.g., administrator level) to information security management systems?

X Administration access to information security management systems is logged and monitored.OutSystems administration consoles provide detailed audit logs for end-user and developer actions, API calls, custom auditing created by the application developer, in-depth monitoring of the OutSystems Cloud servers and a log review practice. Customers are responsible for the auditing of users' activity on their OutSystems applications.

This answer applies to OutSystems Sentry.Identity & Access ManagementUser Access Policy

IAM-02 IAM-02.1 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: • Procedures, supporting roles, and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business relationships, or other third-party business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant)) • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multi-factor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions • Adherence to applicable legal, statutory, or regulatory compliance requirements

Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes?

X Access to OutSystems' information systems is immediately revoked for any terminated/separated employees after communication by human resources team or by the employee manager, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on user access revocation.

A.9.1.1A.9.2.1,A.9.2.2A.9.2.5A.9.1.2A.9.4.1

Identity & Access ManagementUser Access Policy

IAM-02

IAM-02.2

User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: • Procedures, supporting roles, and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business relationships, or other third-party business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant)) • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multi-factor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions • Adherence to applicable legal, statutory, or regulatory compliance requirements

Do you provide metrics to track the speed with which you are able to remove systems access that is no longer required for business purposes?

X Each new/ change/ delete access request is registered on a ticketing tool. It is possible to collect metrics from it.

A.9.1.1A.9.2.1,A.9.2.2A.9.2.5A.9.1.2A.9.4.1

Identity & Access ManagementDiagnostic / Configuration Ports Access

IAM-03 IAM-03.1 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

Do you use dedicated secure networks to provide management access to your cloud service infrastructure?

X OutSystems management access to AWS cloud assets can only be performed using secure protocols over a VPN tunnel.

CC5.1 A.13.1.1A.9.1.1A.9.4.4

Identity & Access ManagementPolicies and Procedures

IAM-04 IAM-04.1 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.

Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access?

X All OutSystems employees have their accesses controlled and documented, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on user identity and access management.

AnnexA.9.2A.9.2.1A.9.2.2A.9.2.3,A.9.2.4,A.9.2.5,A.9.2.6

IAM-04.2 Do you manage and store the user identity of all personnel who have network access, including their level of access?

X All OutSystems employees have their accesses controlled and documented, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on user identity and access management.

Identity & Access ManagementSegregation of Duties

IAM-05 IAM-05.1 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

Do you provide tenants with documentation on how you maintain segregation of duties within your cloud service offering?

X OutSystems maintains clear distinction between the staff responsible for each stage of theplatform delivery, since the development of the software until the availability of the platform to customers, and the operations team. OutSystems SOC 2 reports provide further details on segregation of duties.

CC5.1 A.6.1.2

Identity & Access ManagementSource Code Access Restriction

IAM-06 IAM-06.1 Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

Are controls in place to prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only?

X Access controls are in place that only allow authorized employees to access source code, aligned with ISO 27001 - Annex A.OutSystems SOC 2 reports provide further details on source code access control.

CC7.4 Clause5.2(c)5.3(a),5.3(b),7.5.3(b)7.5.3(d)8.1,8.39.2(g)A.9.4.5A.18.1.3

IAM-06.2 Are controls in place to prevent unauthorized access to tenant application, program, or object source code, and assure it is restricted to authorized personnel only?

X Access controls are in place that only allow authorized employees to access customer data and application, considering their functions and on a need to know basis, aligned with ISO 27001 - Annex A.

Identity & Access ManagementThird Party Access

IAM-07 IAM-07.1 The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

Do you provide multi-failure disaster recovery capability?

X The OutSystems Cloud high-availability option allows customers to continue to operate even in the presence of multiple failures.

CC3.1 A.9.2.6A.9.1.1A.9.2.1, A.9.2.2A.9.2.5

IAM-07.2 Do you monitor service continuity with upstream providers in the event of provider failure?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule.

IAM-07.3 Do you have more than one provider for each service you depend on?

X OutSystems main IaaS provider is AWS. However, OutSystems can also be installed in any other cloud service provider. Customers who use these other clouds are responsible for managing these infrastructures and installation of OutSystems.

More information:https://success.outsystems.com/Support/Enterprise_Customers/Installation/01_Install_and_set_up_OutSystems_Platform

IAM-07.4 Do you provide access to operational redundancy and continuity summaries, including the services you depend on?

X OutSystems has been certified and attested to confirm compliance with ISO 27001, ISO 22301 and SOC 2 Type II standards, by independent auditors. OutSystems SOC 2 reports provide further details on business continuity.

IAM-07.5 Do you provide the tenant the ability to declare a disaster?

X OutSystems customers can contact support 24/7 to report service outages.

IAM-07.6 Do you provide a tenant-triggered failover option? X OutSystems has an automatic failover option in the case of failure and scheduled maintenance.

Identity & Access ManagementThird Party Access

IAM-07

IAM-07.7

The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

Do you share your business continuity and redundancy plans with your tenants?

X OutSystems has been certified and attested to confirm compliance with ISO 27001, ISO 22301 and SOC 2 Type II standards, by independent auditors. OutSystems SOC 2 reports provide further details on business continuity.

CC3.1 A.9.2.6A.9.1.1A.9.2.1, A.9.2.2A.9.2.5

Identity & Access ManagementUser Access Restriction / Authorization

IAM-08 IAM-08.1 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

Do you document how you grant and approve access to tenant data?


CC3.3

AnnexA.9.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.5,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.5

IAM-08.2 Do you have a method of aligning provider and tenant data classification methodologies for access control purposes?

X OutSystems provides a role-based access security model, extensible by tenants.

Identity & Access ManagementUser Access Authorization

IAM-09 IAM-09.1 Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part of the service and/or customer (tenant) has some shared responsibility over implementation of control.

Does your management provision the authorization and restrictions for user access (e.g., employees, contractors, customers (tenants), business partners, and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems, and network components?

X OutSystems follows a formal procedure to authorize/approve users prior to access. Access management on applications developed using OutSystems platform is customers' responsibility.

A.9.2.1, A.9.2.2A.9.2.3A.9.1.2A.9.4.1

IAM-09.2 Do you provide upon request user access (e.g., employees, contractors, customers (tenants), business partners and/or suppliers) to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components?

X OutSystems follows a formal procedure to authorize/approve users prior to access. Infrastructure access and administration is restricted to a limited number of OutSystems employees, considering their functions and on a need to know basis. Administration of the platform can be performed by customers via specific tools.

Identity & Access ManagementUser Access Reviews

IAM-10 IAM-10.1 User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)?

X OutSystems periodically reviews users and access privileges to ensure that users only have the necessary considering their functions and on a need to know basis, aligned with ISO 27001 - Annex A.

A.9.2.5

IAM-10.2 If users are found to have inappropriate entitlements, are all remediation and certification actions recorded?

X OutSystems periodically reviews users and access privileges to ensure that users only have the necessary considering their functions and on a need to know basis, aligned with ISO 27001 - Annex A.

IAM-10.3 Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data?

X OutSystems has monitoring tools which capture inappropriate accesses. This kind of access to customer data is treated as a security incident and dealt as specified in the Security Incident Response Policy, including customer notification and resolution, via Support Portal.

Identity & Access ManagementUser Access Revocation

IAM-11 IAM-11.1 Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change, or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

Is timely deprovisioning, revocation, or modification of user access to the organizations systems, information assets, and data implemented upon any change in status of employees, contractors, customers, business partners, or involved third parties?

X Access to OutSystems' information systems is immediately (1) revoked for any terminated/separated employees; or (2) changed for any transfer/ function changes, after communication by human resources team or by the employee manager.Access management on applications developed using OutSystems platform is customers' responsibility.

OutSystems SOC 2 reports provide further details on access revocation.

Annex AA.9.2.6A.9.1.1A.9.2.1, A.9.2.2A.9.2.3

IAM-11.2 Is any change in user access status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization?

X Access to OutSystems' information systems is immediately (1) revoked for any terminated/separated employees; or (2) changed for any transfer/ function changes, after communication by human resources team or by the employee manager.Access management on applications developed using OutSystems platform is customers' responsibility.

OutSystems SOC 2 reports provide further details on access revocation.

Identity & Access ManagementUser ID Credentials

IAM-12 IAM-12.1 Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures: • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expirable, non-shared authentication secrets)

Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service?

X Tenants may choose to integrate with external authentication and authorization providers. With OutSystems, any authentication mechanism can be implemented depending on the application design.

CC5.3 A.9.2.6A.9.1.1A.9.2.1, A.9.2.2A.9.2.4A.9.2.5A.9.4.2

IAM-12.2 Do you use open standards to delegate authentication capabilities to your tenants?

X OutSystems platform integrates with external authentication providers.

IAM-12.3 Do you support identity federation standards (e.g., SAML, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users?

X OutSystems platform integrates with different identity federation protocols.

IAM-12.4 Do you have a Policy Enforcement Point capability (e.g., XACML) to enforce regional legal and policy constraints on user access?

X Customers can configure roles on the application developed using OutSystems, in order to guarantee that they comply with the regional legal and policy constraints.

IAM-12.5 Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data?

X OutSystems users can be provisioned and granted access to one or more roles. User management can be done from the back-office or through the applications using APIs that are available to developers. Application managers can use a metadata driven back-office to create and configure specific user roles. The definition of a user role is dynamic and independent of the application development phase.

IAM-12.6 Do you provide tenants with strong (multifactor) authentication options (e.g., digital certs, tokens, biometrics, etc.) for user access?

X Customers can develop applications with their own strong multifactor authentication requirements or use a plugin from OutSystems Forge: https://www.outsystems.com/forge/.

Identity & Access ManagementUser ID Credentials

IAM-12

IAM-12.7

Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures: • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expirable, non-shared authentication secrets)

Do you allow tenants to use third-party identity assurance services?

X OutSystems platform integrates with external authentication providers.

CC5.3 A.9.2.6A.9.1.1A.9.2.1, A.9.2.2A.9.2.4A.9.2.5A.9.4.2

IAM-12.8 Do you support password (e.g., minimum length, age, history, complexity) and account lockout (e.g., lockout threshold, lockout duration) policy enforcement?

X To access an AWS account, authorized OutSystems employees log into the AWS web console using multifactor authentication, with strong passwords and account lockout mechanisms.

Customers can develop applications covering all password settings and account lockout policies.

IAM-12.9 Do you allow tenants/customers to define password and account lockout policies for their accounts?

X Customers can develop applications covering all password settings and account lockout policies.

IAM-12.10 Do you support the ability to force password changes upon first logon?

X To access an AWS account, authorized OutSystems employees log into the AWS web console using multifactor authentication, allowing password specification when the account is created.

Customers can develop applications to force password change after the first login.IAM-12.11 Do you have mechanisms in place for unlocking

accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)?

X To access an AWS account, authorized OutSystems employees log into the AWS web console using multifactor authentication, with unlocking mechanisms.

Customers can develop applications with custom unlocking mechanisms, while OutSystems allows by default manual unlocking.

Identity & Access ManagementUtility Programs Access

IAM-13 IAM-13.1 Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

Are utilities that can significantly manage virtualized partitions (e.g., shutdown, clone, etc.) appropriately restricted and monitored?

X Access to utilities that can manage virtualized resources is restricted to authorized OutSystems employees only, considering their functions and on a need to know basis, aligned with ISO 27001 - Annex A.

CC5.1 A.9.1.2 Deleted A.9.4.4

IAM-13.2 Do you have the capability to detect attacks that target the virtual infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?

X This is assured by AWS. The IT infrastructure and operations that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including SOC 2 Type II and ISO 27001. More information: https://aws.amazon.com/security/

IAM-13.3 Are attacks that target the virtual infrastructure prevented with technical controls?


Infrastructure & Virtualization SecurityAudit Logging / Intrusion Detection

IVS-01 IVS-01.1 Higher levels of assurance are required for protection, retention, and lifecycle management of audit logs, adhering to applicable legal, statutory, or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.

Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents?

X OutSystems administration consoles provide detailed audit logs for end-user and developer actions, API calls, custom auditing created by the application developer, in-depth monitoring of the OutSystems Cloud servers and a log review practice, using a combination of tools such as anti-virus, intrusion detection system and file integrity monitoring.

This answer applies to OutSystems Sentry.

CC6.2 A.12.4.1A.12.4.1A.12.4.2, A.12.4.3A.12.4.3A.12.4.1A.9.2.3A.9.4.4A.9.4.1A.16.1.2A.16.1.7A.18.2.3A.18.1.3

IVS-01.2 Is physical and logical user access to audit logs restricted to authorized personnel?

X Log access is restricted to a limited number of OutSystems employees, considering their functions and on a need to know basis.

IVS-01.3 Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been done?

X OutSystems has mapped its security controls to the requirements of ISO 27001, ISO 22301, SOC 2 Type II. You may also refer to CSA CCM v3.0.1 Compliance Mapping.

IVS-01.4 Are audit logs centrally stored and retained? X OutSystems administration consoles provide detailed audit logs for end-user and developer actions, API calls, custom auditing created by the application developer, extended time log retention, in-depth monitoring of the OutSystems Cloud servers and a log review practice. Customers are responsible for the auditing of users' activity on their OutSystems applications.

This answer applies to OutSystems Sentry.IVS-01.5 Are audit logs reviewed on a regular basis for security

events (e.g., with automated tools)?X OutSystems administration consoles provide detailed audit logs for end-user and developer

actions, API calls, custom auditing created by the application developer, in-depth monitoring of the OutSystems Cloud servers and a log review practice, using a combination of tools such as anti-virus, intrusion detection system and file integrity monitoring.

Any unexpected alert, including privacy breaches, either automatically detected or resulting from a human log review, will trigger a Security Incident Response. The Security Incident Response Policy is available at https://success.outsystems.com/Support/Unlisted/Support_Team/Security_Incident_Response_Policy

This answer applies to OutSystems Sentry.Infrastructure & Virtualization SecurityChange Detection

IVS-02 IVS-02.1 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g., dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g., portals or alerts).

Do you log and alert any changes made to virtual machine images regardless of their running state (e.g., dormant, off or running)?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule. The OutSystems Cloud virtual machine images are patched and hardened. OutSystems regularly reviews the configuration standards for OutSystems Cloud environments.

AnnexA.12.1.2A.12.4,A.12.4.1,A.12.4.2,A.12.4.3,A.12.6.1,A.12.6.2,A.16.1.1,A.16.1.2,A.16.1.3,A.16.1.4,A.16.1.5,A.16.1.6,A.16.1.7

IVS-02.2 Are changes made to virtual machines, or moving of an image and subsequent validation of the image's integrity, made immediately available to customers through electronic methods (e.g., portals or alerts)?

X OutSystems installs updates of the operating system and application server regularly, in the event of critical vulnerabilities. AWS automatically schedules security and durability related patches to the database, and OutSystems duly propagates such notifications to customers.

Infrastructure & Virtualization SecurityClock Synchronization

IVS-03 IVS-03.1 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?

X OutSystems Cloud use AWS NTP servers to perform clock synchronization. CC6.2 A.12.4.1A.12.4.4

Infrastructure & Virtualization SecurityCapacity / Resource Planning

IVS-04 IVS-04.1 The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.

Do you provide documentation regarding what levels of system (e.g., network, storage, memory, I/O, etc.) oversubscription you maintain and under what circumstances/scenarios?

X With OutSystems Cloud, each customer has a set of dedicated virtual machines, and can optionally upgrade the specifications of those virtual machines.

A1.1A1.2

CC4.1

A.12.1.3

IVS-04.2 Do you restrict use of the memory oversubscription capabilities present in the hypervisor?

X All infrastructure restrictions (including memory) are handled by AWS.

IVS-04.3 Do your system capacity requirements take into account current, projected, and anticipated capacity needs for all systems used to provide services to the tenants?

X For OutSystems Cloud offer, OutSystems provides guidelines for selecting infrastructure (front-end and database servers).OutSystems supports for horizontal and vertical scalability so customers can scale the computing resources to the demands of their applications, upon request.

IVS-04.4 Is system performance monitored and tuned in order to continuously meet regulatory, contractual, and business requirements for all the systems used to provide services to the tenants?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule. OutSystems supports for horizontal and vertical scalability so customers can scale the computing resources to the demands of their applications, upon request.

OutSystems SOC 2 reports provide further details on monitoring and resource use and optimization.

Infrastructure & Virtualization SecurityManagement - Vulnerability Management

IVS-05 IVS-05.1 Implementers shall ensure that the security vulnerability assessment tools or services accommodate the virtualization technologies used (e.g., virtualization aware).

Do security vulnerability assessment tools or services accommodate the virtualization technologies being used (e.g., virtualization aware)?

X OutSystems runs regular internal and external vulnerability scans on sample OutSystems Cloud infrastructures.

Clause6.1.1,6.1.1(e)(2)6.1.26.1.2(a)(1)6.1.2(a)(2),6.1.2(b)6.1.2 (c)6.1.2(c)(1),6.1.2(c)(2)6.1.2(d)6.1.2(d)(1)6.1.2(d)(2)6.1.2(d)(3)6.1.2(e)6.1.2(e)(1)6.1.2(e)(2)6.1.3,6.1.3(a)6.1.3(b)8.18.39.3(a),9.3(b)9.3(b)(f)9.3(c)9.3(c)(1)9.3(c)(2)9.3(c)(3)9.3(d)9.3(e)9.3(f)

Infrastructure & Virtualization SecurityNetwork Security

IVS-06 IVS-06.1 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and compensating controls.

For your IaaS offering, do you provide customers with guidance on how to create a layered security architecture equivalence using your virtualized solution?

X OutSystems Cloud is PaaS based, by providing a platform which allows software (applications) development.

CC5.6 A.13.1.1A.13.1.2A.14.1.2A.12.4.1A.9.1.2A.13.1.3A.18.1.4

IVS-06.2 Do you regularly update network architecture diagrams that include data flows between security domains/zones?

X OutSystems network architecture is standard and documented. If any change to OutSystems Cloud produces a change on the network flows, these will be updated accordingly, as required by ISO 27001.

IVS-06.3 Do you regularly review for appropriateness the allowed access/connectivity (e.g., firewall rules) between security domains/zones within the network?

X Firewall rules are implemented and enforced automatically and any unauthorized manipulation is treated as a potential security incident.

OutSystems SOC 2 reports provide further details on network security.IVS-06.4 Are all firewall access control lists documented with

business justification?X Only a restricted number of authorized OutSystems employees can access firewalls,

considering their functions and on a need to know basis.Infrastructure & Virtualization SecurityOS Hardening and Base Controls

IVS-07 IVS-07.1 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

Are operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?

X The OutSystems Cloud virtual machine images are regularly patched and hardened (including the removal of unnecessary services). It applies security best practices and inherits the security protections of both Amazon AWS and OutSystems Platform, including several security hardening methods. Configuration standards are based on AWS and third-party hardening guides from well reputed industry sources.

OutSystems SOC 2 reports provide further details on OS hardening.

AnnexA.12.1.4A.12.2.1A.12.4.1A.12.6.1

Infrastructure & Virtualization SecurityProduction / Non-Production Environments

IVS-08 IVS-08.1 Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes?

X OutSystems provides segregated environments for development, testing and production. CC5.6 A.12.1.4A.14.2.9A.9.1.18.1,partial, A.14.2.28.1,partial, A.14.2.38.1,partial, A.14.2.4

IVS-08.2 For your IaaS offering, do you provide tenants with guidance on how to create suitable production and test environments?

X OutSystems Cloud is PaaS based, by providing a platform which allows software (applications) development.

Infrastructure & Virtualization SecurityProduction / Non-Production Environments

IVS-08

IVS-08.3

Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

Do you logically and physically segregate production and non-production environments?

X OutSystems environments are segregated logically: different environments run on different virtual instances.

CC5.6 A.12.1.4A.14.2.9A.9.1.18.1,partial, A.14.2.28.1,partial, A.14.2.38.1,partial, A.14.2.4

Infrastructure & Virtualization SecuritySegmentation

IVS-09 IVS-09.1 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed, and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations: • Established policies and procedures • Isolation of business critical assets and/or sensitive user data and sessions that mandate stronger internal controls and high levels of assurance • Compliance with legal, statutory, and regulatory compliance obligations

Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements?

X OutSystems Cloud uses firewalls, to control which traffic is allowed between the customer environments and the internet.

CC5.6 A.13.1.3A.9.4.1A.18.1.4

IVS-09.2 Are system and network environments protected by a firewall or virtual firewall to ensure compliance with legislative, regulatory, and contractual requirements?


IVS-09.3 Are system and network environments protected by a firewall or virtual firewall to ensure separation of production and non-production environments?


IVS-09.4 Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data?


Infrastructure & Virtualization SecurityVM Security - Data Protection

IVS-10 IVS-10.1 Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.

Are secured and encrypted communication channels used when migrating physical servers, applications, or data to virtual servers?

X When migrating customer data to OutSystems Cloud, secure communication mechanisms can be used to migrate production data (e.g. VPN).

Clause6.1.1,6.1.1(e)(2)6.1.26.1.2(a)(1)6.1.2(a)(2),6.1.2(b)6.1.2 (c)6.1.2(c)(1),6.1.2(c)(2)6.1.2(d)6.1.2(d)(1)6.1.2(d)(2)6.1.2(d)(3)6.1.2(e)6.1.2(e)(1)6.1.2(e)(2)6.1.3,6.1.3(a)6.1.3(b)8.18.39.3(a),9.3(b)9.3(b)(f)9.3(c)9.3(c)(1)9.3(c)(2)9.3(c)(3)9.3(d)9.3(e)9.3(f)A.14.2.3A.12.6.1A.18.1.1A.18.2.2A.18.2.3

IVS-10.2 Do you use a network segregated from production-level networks when migrating physical servers, applications, or data to virtual servers?

X When migrating customer data to OutSystems Cloud, secure communication mechanisms can be used to migrate production data (e.g. VPN).

Infrastructure & Virtualization SecurityVMM Security - Hypervisor Hardening

IVS-11 IVS-11.1 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).

Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?

X Assured by AWS. The IT infrastructure and operations that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including SOC 2 Type II and ISO 27001. More information: https://aws.amazon.com/security/


Infrastructure & Virtualization SecurityWireless Security

IVS-12 IVS-12.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following: • Perimeter firewalls implemented and configured to restrict unauthorized traffic • Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings) • User access to wireless network devices restricted to authorized personnel • The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network

Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic?

X OutSystems has defined a wireless access policy and implemented the corresponding security mechanisms, aligned with ISO 27001 - Annex A.

There are no wireless networks in customer PaaS environments. The IT infrastructure and operations that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including SOC 2 Type II and ISO 27001.

CC5.6 A.8.1.1A.8.1.2A.8.1.3A.11.2.1A.11.2.4A.13.1.1A.13.1.2A.13.2.1A.8.3.3A.12.4.1A.9.2.1, A.9.2.2A.13.1.3A.10.1.1A.10.1.2

Infrastructure & Virtualization SecurityWireless Security

IVS-12

IVS-12.2

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following: • Perimeter firewalls implemented and configured to restrict unauthorized traffic • Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings) • User access to wireless network devices restricted to authorized personnel • The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network

Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, SNMP community strings)?



CC5.6 A.8.1.1A.8.1.2A.8.1.3A.11.2.1A.11.2.4A.13.1.1A.13.1.2A.13.2.1A.8.3.3A.12.4.1A.9.2.1, A.9.2.2A.13.1.3A.10.1.1A.10.1.2

IVS-12.3 Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?



Infrastructure & Virtualization SecurityNetwork Architecture

IVS-13 IVS-13.1 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Do your network architecture diagrams clearly identify high-risk environments and data flows that may have legal compliance impacts?

X OutSystems Cloud network diagrams identify high risk network segments. CC5.6 A.13.1.1A.13.1.2A.14.1.2A.12.4.1A.9.1.2A.13.1.3A.18.1.4

IVS-13.2 Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks?

X OutSystems administration consoles provide detailed audit logs for end-user and developer actions, API calls, custom auditing created by the application developer, in-depth monitoring of the OutSystems Cloud servers and a log review practice, using a combination of tools such as anti-virus, intrusion detection system and file integrity monitoring.


OutSystems Cloud is hosted on AWS which provides significant protection against traditional network security issues such as Distributed Denial of Service, Man-in-the-Middle, IP Spoofing and Port Scanning.


Interoperability & PortabilityAPIs

IPY-01 IPY-01.1 The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.

Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?

X OutSystems provides a set of standard APIs that tenants can use to extend the capabilities of their applications: https://success.outsystems.com/Documentation/10/Reference/OutSystems_APIs


Interoperability & PortabilityData Request

IPY-02 IPY-02.1 All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files).

Is unstructured customer data available on request in an industry-standard format (e.g., .doc, .xls, or .pdf)?

X OutSystems platform allows customers to extract data according to their needs, independently of its structure. The format in which data is extracted depends on tenant requirements and implementation.


Interoperability & PortabilityPolicy & Legal

IPY-03 IPY-03.1 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.

Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications?

X Use of APIs is subject to the same agreement as the rest of the OutSystems Cloud. Clause6.1.1,6.1.1(e)(2)6.1.26.1.2(a)(1)6.1.2(a)(2),6.1.2(b)6.1.2 (c)6.1.2(c)(1),6.1.2(c)(2)6.1.2(d)6.1.2(d)(1)6.1.2(d)(2)6.1.2(d)(3)6.1.2(e)6.1.2(e)(1)6.1.2(e)(2)6.1.3,6.1.3(a)6.1.3(b)8.18.39.3(a),9.3(b)9.3(b)(f)9.3(c)9.3(c)(1)9.3(c)(2)9.3(c)(3)9.3(d)9.3(e)9.3(f)A.14.2.3A.12.6.1A.18.1.1A.18.2.2A.18.2.3

IPY-03.2 Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?

X OutSystems platform allows customers to develop their own applications. As such, customers are responsible for the migration of their data to and from OutSystems Cloud.

Interoperability & PortabilityStandardized Network Protocols

IPY-04 IPY-04.1 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

Can data import, data export, and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols?

X By default HTTP/SSL encryption with TLS 1.2 is always used for both pages and exposed services. Additionally all communications can be tunnelled through a secure VPN tunnel.


IPY-04.2 Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved?

X Documentation is available on OutSystems knowledgebase: https://success.outsystems.com/Evaluation/Security/02_Security_of_OutSystems_applications/04_Secure_OutSystems_applications_and_services_with_HTTPS

Interoperability & PortabilityVirtualization

IPY-05 IPY-05.1 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks, available for customer review.

Do you use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability?

X OutSystems main IaaS provider is AWS, which is a cloud provider leader. Clause6.1.1,6.1.1(e)(2)6.1.26.1.2(a)(1)6.1.2(a)(2),6.1.2(b)6.1.2 (c)6.1.2(c)(1),6.1.2(c)(2)6.1.2(d)6.1.2(d)(1)6.1.2(d)(2)6.1.2(d)(3)6.1.2(e)6.1.2(e)(1)6.1.2(e)(2)6.1.3,6.1.3(a)6.1.3(b)8.18.39.3(a),9.3(b)9.3(b)(f)9.3(c)9.3(c)(1)9.3(c)(2)9.3(c)(3)9.3(d)9.3(e)9.3(f)A.14.2.3A.12.6.1A.18.1.1A.18.2.2A.18.2.3

IPY-05.2 Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review?


Mobile SecurityAnti-Malware

MOS-01

MOS-01.1 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

Do you provide anti-malware training specific to mobile devices as part of your information security awareness training?

X OutSystems maintains a training program which is given to all OutSystems employees and addresses areas such as protection of mobile devices with anti-malware software, aligned with ISO 27001 - Annex A.


Mobile SecurityApplication Stores

MOS-02

MOS-02.1 A documented list of approved application stores has been communicated as acceptable for mobile devices accessing or storing provider managed data.

Do you document and make available lists of approved application stores for mobile devices accessing or storing company data and/or company systems?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating that applications must only be installed from official platform-owner approved sources.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityApproved Applications

MOS-03

MOS-03.1 The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores can be loaded onto a mobile device?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating that installation of code from untrusted sources is forbiddenIt is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityApproved Software for BYOD

MOS-04

MOS-04.1 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

Does your BYOD policy and training clearly state which applications and applications stores are approved for use on BYOD devices?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating that applications must only be installed from official platform-owner approved sourcesIt is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityAwareness and Training

MOS-05

MOS-05.1 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

Do you have a documented mobile device policy in your employee training that clearly defines mobile devices and the accepted usage and requirements for mobile devices?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityCloud Based Services

MOS-06

MOS-06.1 All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

Do you have a documented list of pre-approved cloud based services that are allowed to be used for use and storage of company business data via a mobile device?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and a list of third party cloud-based service providers, aligned with ISO 27001 - Annex A.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityCompatibility

MOS-07

MOS-07.1 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

Do you have a documented application validation process for testing device, operating system, and application compatibility issues?



Mobile SecurityDevice Eligibility

MOS-08

MOS-08.1 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

Do you have a BYOD policy that defines the device(s) and eligibility requirements allowed for BYOD usage?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely eligibility requirements.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityDevice Inventory

MOS-09

MOS-09.1 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices, (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)), will be included for each device in the inventory.

Do you maintain an inventory of all mobile devices storing and accessing company data which includes device status (e.g., operating system and patch levels, lost or decommissioned, device assignee)?



Mobile SecurityDevice Management

MOS-10

MOS-10.1 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

Do you have a centralized mobile device management solution deployed to all mobile devices that are permitted to store, transmit, or process company data?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely centralized management.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityEncryption

MOS-11

MOS-11.1 The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

Does your mobile device policy require the use of encryption for either the entire device or for data identified as sensitive enforceable through technology controls for all mobile devices?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating the requirements for the use of BYOD, namely encryptionIt is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityJailbreaking and Rooting

MOS-12

MOS-12.1 The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting) and is enforced through detective and preventative controls on the device or through a centralized device management system (e.g., mobile device management).

Does your mobile device policy prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting)?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, related to the circumvention of built-in security controls.It is the responsibility of the customer to manage mobile security devices and the access to the customer’s data.


MOS-12.2 Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, related to the circumvention of built-in security controls.It is the responsibility of the customer to manage mobile security devices and the access to the customer’s data.

Mobile SecurityLegal

MOS-13

MOS-13.1 The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations over the loss of non-company data in the case that a wipe of the device is required.

Does your BYOD policy clearly define the expectation of privacy, requirements for litigation, e-discovery, and legal holds?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating that Outsystems has the right to perform full deletion of all data on BYOD.It is the responsibility of the customer to manage mobile security devices and the access to the customer’s data.


MOS-13.2 Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, related to the circumvention of built-in security controls.It is the responsibility of the customer to manage mobile security devices and the access to the customer’s data.

Mobile SecurityLockout Screen

MOS-14

MOS-14.1 BYOD and/or company owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

Do you require and enforce via technical controls an automatic lockout screen for BYOD and company owned devices?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely lock out screens.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityOperating Systems

MOS-15

MOS-15.1 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

Do you manage all changes to mobile device operating systems, patch levels, and applications via your company's change management processes?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely installation of patches and change management.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


Mobile SecurityPasswords

MOS-16

MOS-16.1 Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

Do you have password policies for enterprise issued mobile devices and/or BYOD mobile devices?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, related to the use of secure passwords.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


MOS-16.2 Are your password policies enforced through technical controls (i.e. MDM)?


MOS-16.3 Do your password policies prohibit the changing of authentication requirements (i.e. password/PIN length) via a mobile device?


Mobile SecurityPolicy

MOS-17

MOS-17.1 The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

Do you have a policy that requires BYOD users to perform backups of specified corporate data?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating that backups of corporate data should be performed.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


MOS-17.2 Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating that applications must only be installed from official platform-owner approved sourcesIt is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.

MOS-17.3 Do you have a policy that requires BYOD users to use anti-malware software (where supported)?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, stating that mobile devices must contain anti-malware software It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.

Mobile SecurityRemote Wipe

MOS-18

MOS-18.1 All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

Does your IT provide remote wipe or corporate data wipe for all company-accepted BYOD devices?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely related to data wipe.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


MOS-18.2 Does your IT provide remote wipe or corporate data wipe for all company-assigned mobile devices?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely related to data wipe.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.

Mobile SecuritySecurity Patches

MOS-19

MOS-19.1 Mobile devices connecting to corporate networks or storing and accessing company information shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

Do your mobile devices have the latest available security-related patches installed upon general release by the device manufacturer or carrier?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely related to the installation of security-related patches.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


MOS-19.2 Do your mobile devices allow for remote validation to download the latest security patches by company IT personnel?

X OutSystems has defined internal policies and procedures and implemented controls regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, namely related to the installation of security-related patches.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.

Mobile SecurityUsers

MOS-20

MOS-20.1 The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

Does your BYOD policy clarify the systems and servers allowed for use or access on the BYOD-enabled device?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, including guidelines regarding which roles can use BYOD.It is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.


MOS-20.2 Does your BYOD policy specify the user roles that are allowed access via a BYOD-enabled device?

X OutSystems has defined internal policies and procedures regarding the use of mobile devices and BYOD, aligned with ISO 27001 - Annex A, including guidelines regarding which roles can use BYODIt is the responsibility of the customer to manage the security of mobile devices and the access to the customer’s data.

Security Incident Management, E-Discovery, & Cloud ForensicsContact / Authority Maintenance

SEF-01 SEF-01.1 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations?

X OutSystems maintains contacts with local authorities and key vendors, aligned with ISO 27001 - Annex A.

CC3.3 A.6.1.3A.6.1.4

Security Incident Management, E-Discovery, & Cloud ForensicsIncident Management

SEF-02 SEF-02.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

Do you have a documented security incident response plan?

X OutSystems has defined internal policies and procedures regarding security incidents, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on security incident management.The Security Incident Response Policy is available at https://success.outsystems.com/Support/Unlisted/Support_Team/Security_Incident_Response_Policy

CC5.5

CC6.2

Clause5.3 (a),5.3 (b),7.5.3(b),5.2 (c),7.5.3(d),8.1,8.3,9.2(g),AnnexA.16.1.1A.16.1.2

SEF-02.2 Do you integrate customized tenant requirements into your security incident response plans?

X Customer requirements can be integrated into OutSystems security incident response procedure, depending on the analysis and decision by OutSystems.

Security Incident Management, E-Discovery, & Cloud ForensicsIncident Management

SEF-02

SEF-02.3

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents?

X OutSystems has defined internal policies and procedures regarding security incidents, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on security incident management. This documentation approaches responsibilities for OutSystems.

CC5.5

CC6.2

Clause5.3 (a),5.3 (b),7.5.3(b),5.2 (c),7.5.3(d),8.1,8.3,9.2(g),AnnexA.16.1.1A.16.1.2SEF-02.4 Have you tested your security incident response plans in

the last year?X OutSystems has defined internal policies and procedures regarding security incidents, aligned

with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on security incident management. OutSystems tests its security incident response procedures regularly.

Security Incident Management, E-Discovery, & Cloud ForensicsIncident Reporting

SEF-03 SEF-03.1 Workforce personnel and external business relationships shall be informed of their responsibility and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

Does your security information and event management (SIEM) system merge data sources (e.g., app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting?

X OutSystems administration consoles provide detailed audit logs for end-user and developer actions, API calls, custom auditing created by the application developer, in-depth monitoring of the OutSystems Cloud servers and a log review practice, using a combination of tools including security information and event management (SIEM).

OutSystems has defined internal policies and procedures regarding security incidents, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on incident reporting and analysis.


CC2.3

CC2.5

C1.4C1.5

Clause5.2 (c),5.3 (a),5.3 (b),7.2(a),7.2(b),7.2(c),7.2(d),7.3(b),7.3(c)7.5.3(b),7.5.3(d),8.1,8.3,9.2(g)AnnexA.6.1.1A.7.2.1,A.7.2.2,A.16.1.2,A.16.1.3,A.16.1.1

SEF-03.2 Does your logging and monitoring framework allow isolation of an incident to specific tenants?

X The OutSystems Cloud offer dedicates a Virtual Private Cloud (VPC) for each customer, which ensures complete isolation of the environment of each customer/ tenant from other tenants. This also applies to logging.

Security Incident Management, E-Discovery, & Cloud ForensicsIncident Response Legal Preparation

SEF-04 SEF-04.1 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?

X OutSystems has defined internal policies and procedures regarding security incidents, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on security incident management. OutSystems ensures the chain-of-custody integrity of any evidence.

CC2.5

CC6.2

Clause5.2 (c),5.3 (a),5.3 (b),7.2(a),7.2(b),7.2(c),7.2(d),7.3(b),7.3(c)7.5.3(b),7.5.3(d),8.1,8.3,9.2(g)AnnexA.7.2.2,A.7.2.3,A.16.1.7,A.18.1.3

SEF-04.2 Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques?

X OutSystems has defined internal policies and procedures regarding security incidents, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on security incident management. OutSystems ensures the chain-of-custody integrity of any evidence.

SEF-04.3 Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data?

X The OutSystems Cloud offer dedicates a Virtual Private Cloud (VPC) for each customer, which ensures complete isolation of the environment of each customer/ tenant from other tenants, including data separation.

SEF-04.4 Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?

X The OutSystems Cloud offer dedicates a Virtual Private Cloud (VPC) for each customer, which ensures complete isolation of the environment of each customer/ tenant from other tenants, including data separation.

Security Incident Management, E-Discovery, & Cloud ForensicsIncident Response Metrics

SEF-05 SEF-05.1 Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

Do you monitor and quantify the types, volumes, and impacts on all information security incidents?

X OutSystems has defined internal policies and procedures and implemented controls regarding security incidents, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on security incident management. OutSystems reviews and analyzes security incidents to determine impact, cause and opportunities for corrective action.

CC6.2

CC4.1

A.16.1.6

SEF-05.2 Will you share statistical information for security incident data with your tenants upon request?

X OutSystems can provide statistical information regarding security incidents to its customers, upon request and referring to those customers infrastructure. Support Portal provides information regarding tickets opened by customers, namely for security incidents, using the taxonomy defined by OutSystems.

This answer applies to OutSystems Sentry.Supply Chain Management, Transparency, and AccountabilityData Quality and Integrity

STA-01 STA-01.1 Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain.

Do you inspect and account for data quality errors and associated risks, and work with your cloud supply-chain partners to correct them?

X By default, applications developed using OutSystems feature data input and output integrity checks. The platform also includes tools and mechanisms to guarantee data security and integrity.



STA-01.2 Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?

X By default, applications developed using OutSystems feature data input and output integrity checks. The platform also includes tools and mechanisms to guarantee data security and integrity.


Supply Chain Management, Transparency, and AccountabilityIncident Reporting

STA-02 STA-02.1 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals).

Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?

X OutSystems has defined internal policies and procedures and implemented controls regarding security incidents, aligned with ISO 27001 - Annex A, namely related to communication with customers in case of security incidents. OutSystems SOC 2 reports provide further details on security incident management.


Supply Chain Management, Transparency, and AccountabilityNetwork / Infrastructure Services

STA-03 STA-03.1 Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

Do you collect capacity and use data for all relevant components of your cloud service offering?

X OutSystems proactively monitors system resources, events and availability on a 24/7 schedule. OutSystems provides monitoring tools enabling a proactive management of application performance, including performance monitoring, including client-side, network and server analytics.

CC2.2CC2.3

A.15.1.2A.13.1.2

STA-03.2 Do you provide tenants with capacity planning and use reports?

X OutSystems provides a rich performance monitoring dashboard that makes it easy to understand performance bottlenecks and take action. Performance reports from the management console provide valuable tuning and optimization information for applications.With the infrastructure management console, it's possible to explore how performance of the apps is affecting the end-user experience, on the client, network and server sides.

More information:https://success.outsystems.com/Evaluation/Lifecycle_Management/2_What_kind_of_monitoring_and_analytics_does_OutSystems_offer#Performance_monitoring

Supply Chain Management, Transparency, and AccountabilityProvider Internal Assessments

STA-04 STA-04.1 The provider shall perform annual internal assessments of conformance and effectiveness of its policies, procedures, and supporting measures and metrics.

Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?

X OutSystems has an internal audit function, as required by ISO 27001 and ISO 22301. Clause6.1.1,6.1.1(e)(2)6.1.26.1.2(a)(1)6.1.2(a)(2),6.1.2(b)6.1.2 (c)6.1.2(c)(1),6.1.2(c)(2)6.1.2(d)6.1.2(d)(1)6.1.2(d)(2)6.1.2(d)(3)6.1.2(e)6.1.2(e)(1)6.1.2(e)(2)6.1.3,6.1.3(a)6.1.3(b)8.18.39.3(a),9.3(b)9.3(b)(f)9.3(c)9.3(c)(1)9.3(c)(2)9.3(c)(3)9.3(d)9.3(e)9.3(f)A.14.2.3A.12.6.1A.18.1.1A.18.2.2A.18.2.3

Supply Chain Management, Transparency, and AccountabilityThird Party Agreements

STA-05 STA-05.1 Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms: • Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations) • Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships • Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain) • Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed • Expiration of the business relationship and treatment of customer (tenant) data impacted • Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence

Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored, and transmitted?


CC2.2CC2.3

CC5.5

C1.4C1.5

A.15.1.2,8.1* partial,A.13.2.2,A.9.4.1A.10.1.1

STA-05.2 Do you select and monitor outsourced providers in compliance with laws in the country where the data originates?


STA-05.3 Does legal counsel review all third-party agreements? X OutSystems Legal team reviews agreements with third-parties.STA-05.4 Do third-party agreements include provision for the

security and protection of information and assets?X Agreements with third parties include clauses regarding the security and protection of

information and assets, aligned with ISO 27001 - Annex A.

Supply Chain Management, Transparency, and AccountabilityThird Party Agreements

STA-05

STA-05.5

Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms: • Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations) • Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships • Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain) • Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed • Expiration of the business relationship and treatment of customer (tenant) data impacted • Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence

Do you provide the client with a list and copies of all subprocessing agreements and keep this updated?

X Despite the subprocessing agreements are not shared with customers, due to their sensitivity, customers are aware of the main IaaS provider used by OutSystems (AWS).

CC2.2CC2.3

CC5.5

C1.4C1.5

A.15.1.2,8.1* partial,A.13.2.2,A.9.4.1A.10.1.1

Supply Chain Management, Transparency, and AccountabilitySupply Chain Governance Reviews

STA-06 STA-06.1 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

Do you review the risk management and governanced processes of partners to account for risks inherited from other members of that partner's supply chain?

X OutSystems collects SOC 2 reports from technological providers on an annual basis and uses a security questionnaire to assess the capability of technological suppliers to provide the contracted services in terms of security, in order to understand what risks these suppliers are subject to, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on supplier management.


Supply Chain Management, Transparency, and AccountabilitySupply Chain Metrics

STA-07 STA-07.1 Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream). Reviews shall be performed at least annually and identify non-conformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships.

Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate, and relevant agreements (e.g., SLAs) between providers and customers (tenants)?

X OutSystems has a set of policies and procedures as well as a procurement team responsible for management and maintenance of agreements with suppliers, aligned with ISO 27001 - Annex A. OutSystems SOC 2 reports provide further details on supplier management.


STA-07.2 Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain (upstream/downstream)?


STA-07.3 Can you manage service-level conflicts or inconsistencies resulting from disparate supplier relationships?


STA-07.4 Do you review all agreements, policies, and processes at least annually?


Supply Chain Management, Transparency, and AccountabilityThird Party Assessment

STA-08 STA-08.1 Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party providers upon which their information supply chain depends on.

Do you assure reasonable information security across your information supply chain by performing an annual review?



STA-08.2 Does your annual review include all partners/third-party providers upon which your information supply chain depends?


Supply Chain Management, Transparency, and AccountabilityThird Party Audits

STA-09 STA-09.1 Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

Do you permit tenants to perform independent vulnerability assessments?

X OutSystems Cloud customers can run their own vulnerability scans and penetrations tests on their applications.

CC2.2CC2.3

C1.4C1.5

A.15.1.28.1* partial,8.1* partial, A.15.2.1A.13.1.2

STA-09.2 Do you have external third party services conduct vulnerability scans and periodic penetration tests on your applications and networks?

X OutSystems hires external third party service providers to regularly perform vulnerability scans and penetration tests on a sample of customer OutSystems Cloud infrastructures. The level of standardization of these infrastructures dismisses the needs for vulnerability scans specific to each, as the results and conclusions are transferrable across OutSystems Cloud infrastructures.

OutSystems SOC 2 reports provide further details on security assessments by third parties.Threat and Vulnerability ManagementAntivirus / Malicious Software

TVM-01

TVM-01.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems?

X OutSystems Cloud includes the deployment of anti-virus software on all customer servers, the automatic review of these anti-virus logs, as well as the logs from the intrusion detection system and file integrity monitoring.These are managed from OutSystems employees computers with centrally managed and regularly updated anti-virus software, aligned with ISO 27001 - Annex A.

OutSystems SOC 2 reports provide further details on anti-malware software.


CC5.8 A.12.2.1

TVM-01.2 Do you ensure that security threat detection systems using signatures, lists, or behavioral patterns are updated across all infrastructure components within industry accepted time frames?

X OutSystems Cloud includes the deployment of anti-virus software on all customer servers, the automatic review of these anti-virus logs, as well as the logs from the intrusion detection system and file integrity monitoring.These are managed from OutSystems employees computers with centrally managed and regularly updated anti-virus software, aligned with ISO 27001 - Annex A.

OutSystems SOC 2 reports provide further details on anti-malware software.

This answer applies to OutSystems Sentry.Threat and Vulnerability ManagementVulnerability / Patch Management

TVM-02

TVM-02.1 Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g., network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?

X OutSystems regularly performs vulnerability scans on a sample of customer OutSystems Cloud infrastructures.

CC7.1 8.1*partial, A.14.2.2,8.1*partial, A.14.2.3A.12.6.1

TVM-02.2 Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?

X OutSystems performs regularly penetration tests on the OutSystems management consoles. OutSystems Cloud customers can run their own vulnerability scans and penetrations tests on their applications.

TVM-02.3 Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?


TVM-02.4 Will you make the results of vulnerability scans available to tenants at their request?

X OutSystems Cloud customers can run their own vulnerability scans and penetrations tests on their applications.

TVM-02.5 Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications, and systems?

X OutSystems regularly reviews the configuration standards for OutSystems Cloud environments, aligned with ISO 27001 - Annex A. This occurs whenever needed, or at least quarterly.

OutSystems SOC 2 reports provide further details on patch management.TVM-02.6 Will you provide your risk-based systems patching time

frames to your tenants upon request?X OutSystems regularly reviews the configuration standards for OutSystems Cloud

environments, aligned with ISO 27001 - Annex A. This occurs whenever needed, or at least quarterly.

OutSystems SOC 2 reports provide further details on patch management.Threat and Vulnerability ManagementMobile Code

TVM-03

TVM-03.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy?

X Since OutSystems is a platform which allows software (applications) development, customers are responsible for the mobile code they might produce.

CC5.6

CC7.1

A.12.2.1

TVM-03.2 Is all unauthorized mobile code prevented from executing?

X Since OutSystems is a platform which allows software (applications) development, customers are responsible for the mobile code they might produce.

© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Consensus Assessments Initiative Questionnaire CAIQ Version 3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Consensus Assessments Initiative Questionnaire v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be modified or altered in any way; (c) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Consensus Assessments Initiative Questionnaire v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Consensus Assessments Initiative Questionnaire 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.0 · CONSENSUS ASSESSMENTS INITIATIVE...

Documents

Transcript of CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.0 · CONSENSUS ASSESSMENTS INITIATIVE...